ZooBC wiki
Proof of Participation

The block seed (VRF)

Every ZooBC block carries a 64-byte seed, the chain's source of randomness. It decides who may make the next block, who wins the coinbase lottery, which receipts a producer shows and how peers are assigned to each other. From version 0.5.8 the seed is the output of a verifiable random function (VRF): for a given producer and a given previous seed there is exactly one valid value, and a short proof in the block header lets every node check it.

Why the seed must not be choosable

If a producer could pick its block's seed from several candidates, it could steer the next producer draw towards itself or a partner, tilt the coinbase lottery or decide the outcome of an app's bet. A plain digital signature would not be enough as a seed: more than one valid signature can exist over the same message, so a producer could try several and keep the one it liked.

A VRF closes that door. It works like a signature that has only one valid result: whoever holds the key can compute the output and a proof, anyone with the public key can verify the proof, and every valid proof for the same key and input yields the same output.

Left: a signature seed has many valid outputs and the producer picks one. Right: a VRF seed has exactly one value plus an 80-byte proof that every validator checks.
Left: a signature seed has many valid outputs and the producer picks one. Right: a VRF seed has exactly one value plus an 80-byte proof that every validator checks.

How a seed is made

  1. The input, called alpha, is the SHA3-256 hash of the previous block's 64-byte seed (32 bytes).
  2. The producer runs ECVRF over Ed25519, in a ZooBC variant, with its node key (see keys of a node).
  3. The output is the new 64-byte seed. The proof is 80 bytes: a 32-byte curve point, a 16-byte challenge and a 32-byte scalar.
  4. The proof goes into the block header, which the block signature covers: 284 header bytes are signed (204 bytes of other fields plus the 80-byte proof) and 348 bytes are hashed.

Validators require the proof, verify it under the producer's key over alpha, and refuse a block whose seed is not the proof's output.

Nothing from the new block is an input: not its transactions, not its timestamp. A producer therefore cannot steer the seed by rearranging its block, and the chain of seeds can be checked from any block back to the genesis block, whose seed is all zeros. A random number from the producer's own computer could not be verified by anyone, which is why none is used.

The previous seed is hashed into alpha; alpha and the producer's node key go into ECVRF, which outputs the 64-byte seed and the 80-byte proof, both carried in the header. Transactions and timestamp are not inputs.
The previous seed is hashed into alpha; alpha and the producer's node key go into ECVRF, which outputs the 64-byte seed and the 80-byte proof, both carried in the header. Transactions and timestamp are not inputs.

The ZooBC variant

ZooBC's ECVRF is a variant of ECVRF-EDWARDS25519-SHA512-TAI. Hashing to the curve accepts only candidate points of prime order and uses them without the cofactor, and verification also refuses a proof whose challenge or scalar is zero. A stock RFC 9381 library therefore gives different outputs; anyone writing a node or a verifier must implement the variant.

For about one pair of key and input in 15 million (a probability of (15/16)^256, about 6.7 × 10^-8) no valid proof exists. The drawn producer then cannot make that block, and the turn passes to the producer of the next round.

The one lever left: abstaining

A drawn producer that dislikes the seed its block would carry has one option: to withhold the block. The turn then passes to the next drawn node, 15 seconds later, which makes the block with its own seed, just as unpredictable. Withholding re-rolls the dice once; it never chooses the result.

It also has a price. The skipped producer counts a missed turn and is "missing" until its next own block, earning nothing and losing participation score (see missed turns, suspension and expulsion). The later block weighs less in fork choice and cumulative difficulty. The design analysis of Proof of Participation puts the chance that an adversary holding a fraction a of the seats can predict the seed n blocks ahead at about a to the power n: with a third of the seats, about 1 in 27 for three blocks.

Two further rules close the side doors:

  • A change of node key takes effect only 120 blocks (30 minutes) after the block that includes it, so a producer cannot steer a partner's next seed with a key rotation signed in advance.
  • The producer of the previous block is demoted in the next draw, so no node holds both a block's contents and the seed that settles them while another node is able to answer (see priority rounds, empty blocks and the previous producer).

What the seed decides

Seeds are public: anyone can read them from the chain and repeat every one of these draws.

See also